INF.9 Mobile Workplace

An organisation MUST stipulate how employees are to select and use mobile workplaces in a suitable way. It MUST define the features that are desirable for a mobile workplace. It MUST also define the criteria that rule out a mobile workplace. At minimum, the following MUST be specified:

• workplace conditions that are allowed for processing sensitive information
• how employees at mobile workplaces should protect their information against unwanted third-party access
• whether a continuous network and power supply is required
• workplace environments that are absolutely forbidden

For all work done on the move, the information that may be transported and processed outside the organisation at hand MUST be regulated, along with the protective safeguards to be taken. The framework conditions required in order for employees with mobile IT systems to access their organisation's internal information MUST also be defined.

There MUST be clear rules governing the transportation of IT components and storage media. These MUST specify the IT systems and storage media that are allowed to be transported, the persons authorised to transport them, and the basic security requirements to be considered.

Records MUST be kept as to who has used which mobile devices at what times while not on their organisation's premises.

The users of mobile devices MUST be made aware of the value of mobile IT systems and the information stored on them. They MUST be informed of the specific threats and safeguards regarding the IT systems they use. Moreover, they MUST be informed of the types of information that may be processed on mobile IT systems. All users MUST be informed of the rules they need to follow. They MUST be trained accordingly.

Employees MUST be informed of the rules and safeguards to be considered with regard to intrusion and site access protection at mobile workplaces. When a mobile workplace is not in use, the windows and doors MUST be closed. If this is not possible, such as on a train, employees MUST store all their documents and IT systems in a secure location when they are absent or take them with them. It MUST be ensured that unauthorised persons cannot access work-related IT or documents at any time. If a workplace is only left for a short time, the IT systems in use MUST be locked so that they can only be used again after successful authentication.

An organisation MUST specify how employees may work with external IT systems. Every mobile employee MUST be informed about the dangers of third-party IT systems. The regulations MUST specify whether and how sensitive information may be processed on third-party IT systems. They MUST also specify how to prevent unauthorised persons from viewing such information. If employees work with external IT systems, it MUST be ensured in principle that all temporary data created during such periods is deleted.

Employees SHOULD report any loss or theft of information, IT systems, or storage media to their organisation immediately. To this end, there SHOULD be clear reporting channels and contact persons within the organisation.

Confidential information SHOULD be disposed of securely, even on the move. Before old or defective storage media and documents are destroyed, they MUST be checked for sensitive information. If they contain sensitive information, storage media and documents MUST be returned and disposed of or destroyed using the respective organisation’s methods.

Framework conditions pertaining to labour regulations and occupational safety laws SHOULD be observed and specified for mobile working. All the relevant aspects SHOULD be clarified in employment agreements, or in separate agreements between mobile employees and their employers as a supplement to their employment contracts.

All the relevant security requirements for mobile workplaces SHOULD be documented in a security policy that is mandatory for mobile employees. Furthermore, this policy SHOULD be adapted to the existing security policies of the organisation in question and agreed with all its relevant departments. The security policy for mobile workplaces SHOULD be updated regularly. The employees of the organisation SHOULD be made aware of and trained in its current security policy.

It SHOULD be ensured that portable IT systems and storage media are secured in line with the respective organisation's internal guidelines. Mobile IT systems and storage media SHOULD be encrypted. Cryptographic keys SHOULD be stored separately from the corresponding encrypted devices.

When IT systems are used at mobile workplaces, employees SHOULD use privacy screens.

If an IT system in use provides a means of anti-theft protection, this SHOULD be used. Anti-theft devices SHOULD always be used in places with increased public traffic or a high rate of user fluctuation. In this respect, employees SHOULD always take into account that the protection of the information stored on an IT system usually has a higher value than the cost of the system itself. The acquisition and usage criteria for anti-theft devices SHOULD be adapted to an organisation’s processes and documented.

The minimum criteria that mobile working environments must fulfil to allow the processing of information with increased protection needs SHOULD be determined. The criteria should cover the following topics at minimum:

• access and viewing by third parties
• closed and, if required, lockable or guarded rooms
• secured communication options
• a sufficient power supply